X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=9ada9b6c5060c54ba2e8d1e3ca1df52c642634e9;hb=HEAD;hp=eb3689ebf535c4aa162ad884443aea6d2b6e0bed;hpb=f27b67a1dfa58b5f101bba607b2f91a73e65299e;p=distro-setup diff --git a/mail-setup b/mail-setup index eb3689e..616d39b 100755 --- a/mail-setup +++ b/mail-setup @@ -41,15 +41,15 @@ # /usr/sbin/invoke-rc.d-diverted "$@" # fi -# Things I tend to forget. on MAIL_HOST, daemon runs with /etc/exim4/my.conf, +# Things I tend to forget. on MAIL_HOST, daemon runs with /etc/exim4/nn-mainlog.conf, # due to /etc/default/exim4 containing: -# COMMONOPTIONS='-C /etc/exim4/my.conf' -# UPEX4OPTS='-o /etc/exim4/my.conf' +# COMMONOPTIONS='-C /etc/exim4/nn-mainlog.conf' +# UPEX4OPTS='-o /etc/exim4/nn-mainlog.conf' # # The non-daemon config -# gets generated from this script calling update-exim4.conf -d /etc/myexim4 +# gets generated from this script calling update-exim4.conf -d /etc/nond-exim4 # which has log path -# log_file_path = /var/log/exim4/my%s +# log_file_path = /var/log/exim4/nond%s # # On non bk|MAIL_HOST, the config and log file are all standard. # @@ -361,28 +361,8 @@ reload=false if [[ -e /var/local/mail-setup-reload ]]; then reload=true fi -u() { # update file. note: duplicated in brc - local tmp tmpdir dest="$1" - local base="${dest##*/}" - local dir="${dest%/*}" - if [[ $dir != "$base" ]]; then - # dest has a directory component - mkdir -p "$dir" - fi - ur=false # u result - tmpdir=$(mktemp -d) - cat >$tmpdir/"$base" - tmp=$(rsync -ic $tmpdir/"$base" "$dest") - if [[ $tmp ]]; then - printf "%s\n" "$tmp" - ur=true - if [[ $dest == /etc/systemd/system/* ]]; then - touch /var/local/mail-setup-reload - reload=true - fi - fi - rm -rf $tmpdir -} + +source /a/bin/fai/fai/config/distro-install-common/bash-misc-funcs setini() { key="$1" value="$2" section="$3" file="/etc/radicale/config" @@ -473,9 +453,17 @@ Pin-Priority: 500 EOF fi + +unit-exists() { + systemctl cat $1 &>/dev/null +} +spamd-timer-exists() { + unit-exists spamassassin-maintenance.timer +} + # name change in t12, and now timer instead of cron option in /etc/default first_spamd_run=false -if ! systemctl cat spamassassin-maintenance.timer &>/dev/null; then +if ! spamd-timer-exists; then first_spamd_run=true fi @@ -488,10 +476,14 @@ spamd_ser=spamd if systemctl cat spamassassin &>/dev/null; then spamd_ser=spamassassin elif $first_spamd_run; then - systemctl start spamassassin-maintenance + if spamd-timer-exists; then + systemctl start spamassassin-maintenance + fi fi -systemctl enable --now spamassassin-maintenance.timer +if spamd-timer-exists; then + systemctl enable --now spamassassin-maintenance.timer +fi # note: pyzor debian readme says you need to run some initialization command # but its outdated. @@ -581,30 +573,17 @@ case $HOSTNAME in esac -lines=( - "/etc/resolved-nsswitch/nsswitch.conf r," - "/etc/basic-nsswitch/nsswitch.conf r," - # Aug 06 23:09:11 kd audit[3995]: AVC apparmor="DENIED" operation="connect" profile="/usr/bin/freshclam" name="/run/systemd/resolve/io.systemd.Resolve" pid=3995 comm="freshclam" requested_mask="wr" denied_mask="wr" fsuid=109 ouid=101 - # I dont know if this is quite the right fix, but I saw other sockets - # in the nameservice files that were rw, so figured it was ok to add this and it worked. - "/run/systemd/resolve/io.systemd.Resolve rw," -) -f=/etc/apparmor.d/abstractions/nameservice -apparmor_reload=false -if [[ -e $f ]]; then - for l in "${lines[@]}"; do - if ! grep -qF "$l" $f; then - sudo sed -i "/\/nsswitch.conf/a $l" $f - apparmor_reload=true - if ! grep -qF "$l" $f; then - echo "$0: failed editing $f. investigate" - exit 1 - fi - fi - done - if $apparmor_reload && systemctl is-active apparmor; then - m ser reload apparmor - fi +u /etc/apparmor.d/abstractions/nameservice.d/iank <<'EOF' +/etc/resolved-nsswitch/nsswitch.conf r, +/etc/basic-nsswitch/nsswitch.conf r, +# Aug 06 23:09:11 kd audit[3995]: AVC apparmor="DENIED" operation="connect" profile="/usr/bin/freshclam" name="/run/systemd/resolve/io.systemd.Resolve" pid=3995 comm="freshclam" requested_mask="wr" denied_mask="wr" fsuid=109 ouid=101 +# I dont know if this is quite the right fix, but I saw other sockets +# in the nameservice files that were rw, so figured it was ok to add this and it worked. +/run/systemd/resolve/io.systemd.Resolve rw, +EOF + +if $ur && systemctl is-active apparmor; then + m systemctl reload apparmor fi @@ -3084,10 +3063,11 @@ case $HOSTNAME in # which will overwrite any existing file u /etc/default/exim4 <<'EOF' QUEUERUNNER='combined' -# note: this is duplicated in brc2, 10m here is -q10m there. QUEUEINTERVAL='10m' -COMMONOPTIONS='-C /etc/exim4/my.conf' -UPEX4OPTS='-o /etc/exim4/my.conf' +COMMONOPTIONS='-C /etc/exim4/nn-mainlog.conf' +UPEX4OPTS='-o /etc/exim4/nn-mainlog.conf' +# in t12 exim, this replaces all the above options +EXIMSERVICE='-bdf -q10m -C /etc/exim4/nn-mainlog.conf' # i use epanic-clean for alerting if there are bad paniclog entries E4BCD_WATCH_PANICLOG='no' EOF @@ -3097,13 +3077,13 @@ EOF chmod g+s,u+s /usr/sbin/exim4 # need this to avoid error on service reload: # 2022-08-07 18:44:34.005 [892491] pid 892491: SIGHUP received: re-exec daemon - # 2022-08-07 18:44:34.036 [892491] cwd=/var/spool/exim4 5 args: /usr/sbin/exim4 -bd -q30m -C /etc/exim4/my.conf + # 2022-08-07 18:44:34.036 [892491] cwd=/var/spool/exim4 5 args: /usr/sbin/exim4 -bd -q30m -C /etc/exim4/nn-mainlog.conf # 2022-08-07 18:44:34.043 [892491] socket bind() to port 25 for address (any IPv6) failed: Permission denied: waiting 30s before trying again (9 more tries) # note: the daemon gives up and dies after retrying those 9 times. # I came upon this by guessing and trial and error. setcap CAP_NET_BIND_SERVICE+ei /usr/sbin/exim4 u /etc/exim4/trusted_configs <<'EOF' -/etc/exim4/my.conf +/etc/exim4/nn-mainlog.conf EOF ;; *) @@ -3285,6 +3265,10 @@ bounce_debbugs: EOF install -m=0775 -d -g Debian-exim -o iank /var/spool/exim4/gw + f=/var/spool/exim4/gw/.no-delay-eximids + if [[ ! -e $f ]]; then + install -g Debian-exim -o iank /dev/null $f + fi u /etc/exim4/conf.d/router/155_delay <<'EOF' # By default, delay sending email by 30-40 minutes in case I # change my mind. @@ -3566,7 +3550,7 @@ EOF # defaults but no queue runner and alternate config dir QUEUERUNNER='no' COMMONOPTIONS='-oP /run/exim4/eximin.pid' -UPEX4OPTS='-d /etc/myexim4' +UPEX4OPTS='-d /etc/nond-exim4' EOF echo bk.b8.nz > /etc/mailname @@ -3726,16 +3710,16 @@ case $HOSTNAME in m rsync -ra --delete --delete-excluded \ --exclude=/conf.d/router/161_backup_redir_nn \ --exclude=/conf.d/router/186_sentarchive_nn \ - --exclude=/conf.d/main/000_local-nn /etc/exim4/ /etc/myexim4 - cat >>/etc/myexim4/conf.d/main/000_local <<'EOF' + --exclude=/conf.d/main/000_local-nn /etc/exim4/ /etc/nond-exim4 + cat >>/etc/nond-exim4/conf.d/main/000_local <<'EOF' # this makes it easier to see which exim is doing what -log_file_path = /var/log/exim4/my%s +log_file_path = /var/log/exim4/nond%s EOF cat >/etc/logrotate.d/myexim <<'EOF' -/var/log/exim4/mymain /var/log/exim4/myreject { +/var/log/exim4/nondmain /var/log/exim4/nondreject { daily missingok rotate 1000 @@ -3743,7 +3727,7 @@ EOF notifempty nocreate } -/var/log/exim4/mypanic { +/var/log/exim4/nondpanic { size 10M missingok rotate 10 @@ -3757,9 +3741,9 @@ EOF # If we ever wanted to have a separate spool, # we could do it like this. # cat >>/etc/exim4/conf.d/main/000_local-nn <<'EOF' - # spool_directory = /var/spool/myexim4 + # spool_directory = /var/spool/nond-exim4 # EOF - cat >>/etc/myexim4/update-exim4.conf.conf <<'EOF' + cat >>/etc/nond-exim4/update-exim4.conf.conf <<'EOF' dc_eximconfig_configtype='smarthost' dc_smarthost='nn.b8.nz' EOF @@ -3767,14 +3751,14 @@ EOF bk) # config for the non-nn exim - cat >>/etc/myexim4/conf.d/main/000_local <<'EOF' + cat >>/etc/nond-exim4/conf.d/main/000_local <<'EOF' MAIN_HARDCODE_PRIMARY_HOSTNAME = mail2.iankelling.org EOF ;; $MAIL_HOST) - u /etc/myexim4/conf.d/router/185_sentarchive <<'EOF' + u /etc/nond-exim4/conf.d/router/185_sentarchive <<'EOF' sentarchive: driver = redirect domains = ! +local_domains @@ -3784,7 +3768,7 @@ sentarchive: unseen EOF - u /etc/myexim4/conf.d/router/160_backup_redir <<'EOF' + u /etc/nond-exim4/conf.d/router/160_backup_redir <<'EOF' backup_redir: driver = redirect # i dont email myself from my own machine much, so lets ignore that. @@ -3801,7 +3785,7 @@ backup_redir: EOF # for bk, we have a exim4in.service that will do this for us. - m update-exim4.conf -d /etc/myexim4 + m update-exim4.conf -d /etc/nond-exim4 ;; esac @@ -3888,6 +3872,131 @@ fi # err debbugs exist but is not uid 610: investigate # fi +# * mail monitoring / testing + +# note, to test clamav, send an email with body that only contains +# https://en.wikipedia.org/wiki/EICAR_test_file +# which set malware_name to Eicar-Signature +case $HOSTNAME in + $MAIL_HOST|bk|je) + # note: cronjob "ian" also does some important monitoring + # todo: this will sometimes cause an alert because mailtest-check will run + # before we have setup network namespace and spamassassin + u /etc/cron.d/mailtest <>/etc/cron.d/mailtest </usr/local/bin/send-test-forward <<'EOF' +#!/bin/bash +# we remove from the queue older than 4.3 minutes since we send every 5 minutes. +olds=( +$(/usr/sbin/exiqgrep -o 260 -i -r '^(testignore@(iankelling\.org|zroe\.org|expertpathologyreview\.com|amnimal\.ninja|je\.b8\.nz)|jtuttle@gnu\.org)$') +) +if (( ${#olds[@]} )); then + /usr/sbin/exim -Mrm "${olds[@]}" >/dev/null +fi +EOF + for test_from in ${test_froms[@]}; do + + test_to=${test_tos[0]} + for t in ${test_tos[@]:1}; do + if [[ $test_from == *@gnu.org && $t == *@gnu.org ]]; then + continue + fi + test_to+=", $t" + done + case $test_from in + testignore@expertpathologyreview.com) + test_to=testignore@zroe.org + ;; + esac + + cat >>/usr/local/bin/send-test-forward <>/etc/cron.d/mailtest </usr/local/bin/send-test-forward <<'EOF' -#!/bin/bash -# we remove from the queue older than 4.3 minutes since we send every 5 minutes. -olds=( -$(/usr/sbin/exiqgrep -o 260 -i -r '^(testignore@(iankelling\.org|zroe\.org|expertpathologyreview\.com|amnimal\.ninja|je\.b8\.nz)|jtuttle@gnu\.org)$') -) -if (( ${#olds[@]} )); then - /usr/sbin/exim -Mrm "${olds[@]}" >/dev/null -fi -EOF - for test_from in ${test_froms[@]}; do - - test_to=${test_tos[0]} - for t in ${test_tos[@]:1}; do - if [[ $test_from == *@gnu.org && $t == *@gnu.org ]]; then - continue - fi - test_to+=", $t" - done - case $test_from in - testignore@expertpathologyreview.com) - test_to=testignore@zroe.org - ;; - esac - - cat >>/usr/local/bin/send-test-forward <